VulnerabilityModified
CVE-2020-24314
This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
MEDIUM 6.1EPSS 0.87%
Does this matter?
Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own.
Description
Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- rss feed widget project/rss feed widget
- Source
- cve@mitre.org
References
- https://wordpress.org/plugins/rss-feed-widget/advanced/Product, Third Party Advisory
- https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/Exploit, Third Party Advisory, URL Repurposed
- https://wordpress.org/plugins/rss-feed-widget/advanced/Product, Third Party Advisory
- https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/Exploit, Third Party Advisory, URL Repurposed
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.